Cookie policy: what to publish on your school website
Your cookie policy explains each cookie your website sets, what it does and which ones need consent.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When it's due
Keep it up to date
There's no fixed date. Update it whenever something changes.
What's needed
Publish a cookie policy on your website listing each cookie, what it does, how long it lasts and how to change consent, and link to it from the footer of every page.
In this requirement
Section 1 of 2
Clear cookie information
The website must explain clearly what cookies it uses and why, usually in a cookie policy: users told that cookies are set and why, cookies listed with purposes, clear and comprehensive information about the purpose, what happens if you allow them, and information that covers all the cookies used.
The register sets this section for maintained schools only.
What it must contain
7 parts- Explains what each cookie does and why it's usedMust: Required by law, statutory guidance or the academy's funding agreement.
- Dates when the cookie information was last reviewedMust: Required by law, statutory guidance or the academy's funding agreement.
- Gives clear and comprehensive information about why cookies are stored or accessedMust: Required by law, statutory guidance or the academy's funding agreement.
- Explains what happens if a visitor allows each cookieMust: Required by law, statutory guidance or the academy's funding agreement.
- Gives information about cookies that don't need consent tooGood practice: Recommended as good practice. Not required.
- Tells visitors that the website sets cookiesMust: Required by law, statutory guidance or the academy's funding agreement.
- Explains what the cookies do and whyMust: Required by law, statutory guidance or the academy's funding agreement.
What the official sources say
Set out in 3 official sources:
Guide to PECR: cookies and similar technologies
You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given.
Must: Required by law, statutory guidance or the academy's funding agreement.§ In brief…
The rules on cookies are in regulation 6. The basic rule is that you must: – tell people the cookies are there; – explain what the cookies are doing and why; and – get the person’s consent to store a cookie on their device.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What do we need to do to comply?
Show 9 more from this source
The only requirement is that it must be “clear and comprehensive” information about your purposes. You must explain the way the cookies (or other similar technologies) work and what you use them for, and the explanation must be clear and easily available. Users must be able to understand the potential consequences of allowing the cookies. You may need to make sure the language and level of detail are appropriate for your intended audience.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What information must we give users?
It must involve some form of unambiguous positive action – for example, ticking a box or clicking a link – and the person must fully understand that they are giving you consent. You cannot show consent if you only provide information about cookies as part of a privacy policy that is hard to find, difficult to understand, or rarely read. Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What counts as consent?
Yes. Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Do the rules still apply if the data is anonymous?
This must be more than simply continuing to use the website. To ensure that consent is freely given, users should have the means to enable or disable non-essential cookies, and you should make this easy to do.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ What counts as consent?
You should take particular care to ensure clear and specific consent for more privacy-intrusive cookies, such as those collecting sensitive personal data such as health details, or used for behavioural tracking.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ What counts as consent?
☐ We have ensured that we provide clear and easy to understand information about the cookies we use. ☐ We have ensured that our information is comprehensive and covers all the cookies we use.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ Checklists – Information about cookies
☐ We have implemented a consent mechanism that allows users of our online service to control the setting of all cookies that are not strictly necessary.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ Checklists – Consent for cookies
However, it is still good practice to provide users with information about these cookies, even if you do not need consent.
Good practice: Recommended as good practice. Not required.§ Are there any exemptions?
Although this guide focuses on cookies, regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What else is covered, apart from cookies?
PECR 2003 Schedule A1 (cookies: information and consent conditions, inserted by the Data (Use and Access) Act 2025)
a is provided with clear and comprehensive information about the purpose of the storage or access, and b gives consent to the storage or access.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Schedule A1, paragraph 2(1)(b) (Consent)
Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies)
Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Regulation 6(1)
Section 2 of 2
Naming the third parties
The cookie policy should name the third-party services that actually set cookies, such as Google Analytics or YouTube, say what each cookie does and why, show which cookies are strictly necessary and cover all the cookies used. The audit compares the policy with what really loads.
The register sets this section for maintained schools only.
What it must contain
2 parts- Covers every cookie the website usesShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Says which cookies are strictly necessary and which need consentMust: Required by law, statutory guidance or the academy's funding agreement.
What the official sources say
Set out in 1 official source:
Guide to PECR: cookies and similar technologies
the cookie is strictly necessary to provide an ‘information society service’ (eg a service over the internet) requested by the subscriber or user. Note that it must be essential to fulfil their request – cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Are there any exemptions?
Questions schools ask
Do schools need a cookie policy on their website?
Clear cookie information: Academies and maintained schools must. Naming the third parties: For academies and maintained schools, it's recommended in official guidance, but isn't a legal requirement in itself.
What does a school cookie policy need to include?
Explains what each cookie does and why it's used; Dates when the cookie information was last reviewed; clear and comprehensive information about why cookies are stored or accessed; Explains what happens if a visitor allows each cookie; information about cookies that don't need consent too; Tells visitors that the website sets cookies; and 3 more parts listed above.
When do we need to update our cookie policy?
Keep it up to date. There's no fixed date. Update it whenever something changes.
Where does the requirement for the cookie policy come from?
It is set out in Guide to PECR: cookies and similar technologies, PECR 2003 Schedule A1 (cookies: information and consent conditions, inserted by the Data (Use and Access) Act 2025) and Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies).
Recent changes to the official guidance
The official sources for this requirement don't publish dated change notes. We check them for changes ourselves.
We last checked these sources on 21 September 2026.
Is this on your school's website?
Enter your school email address and we'll check your website for this requirement.
It's free, and the result arrives by email.
Official sources last checked 21 September 2026 · register version 1.0.4